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Abstract 

We provide a recursive description of the signatures realizable on the 
standard basis by a holographic algorithm. The description allows us to 
prove tight bounds on the size of planar matchgates and efficiently test for 
standard signatures. Over finite fields, it allows us to count the number 
of n-bit standard signatures and calculate their expected sparsity. 
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1 Introduction 



Holographic algorithms have been a subject of much interest in the mathe- 
matical community since Leslie Valiant conceived of them in 2002 (see [12]). 
These algorithms can calculate certain exponential sums in polynomial 
time, skating dangerously close to #P problems. 

This paper will examine one small aspect of holographic algorithms; 
our narrow focus will allow us to avoid some of the details and much 
of the terminology surrounding the subject. However, to provide a little 
context for the reader unfamiliar with holographic computing, we will give 
an extremely rough sketch of the subject in the next paragraph. More 
precise and complete introductions can be found in |14] or [2]. 

We can think of holographic computing as follows. Fix a field F. 
Imagine that we build a circuit board out of special circuit components. 
Each component has a certain number of wires which we can attach to 
other components. We attach the wires so that none of them cross on the 
circuit board. (In other words, if we treat the circuit components as nodes 
and the wires as edges, we form a planar graph.) Each wire can take on 
only two values, either zero or one. If we specify the values of the wires 
attached to a component, it produces an output value lying in F. (If a 
component has n wires, this function from {0, 1}" to F is the "signature" 
referred to in the title; we would call it an "n-bit standard signature".) If 
we set all the wires on the entire circuit board, we define the entire circuit 
board as producing the product of the outputs of the individual circuit 
components. A holographic algorithm lets us compute the sum of these 
products over all (exponentially many) wire settings in polynomial time. 

If the signatures could be chosen freely, it would follow that P = #P. 
Sadly, if not surprisingly, we lack this freedom: only some functions are 
hospitable to holographic manipulations. These special functions are said 
to be realizable on the standard basis, or are simply called the standard 
signatures. It is possible to change our computational basis, which pro- 
duces new sets of signatures. Much of the power of holographic algorithms 
arise from these changes of basis; however, this paper focuses only on the 
simpler case of the standard basis. 

So, which functions are standard signatures? Three equivalent defini- 
tions are frequently used. Standard signatures were originally denned in 
terms of sums of weighted matchings on planar graphs by Valiant in |13| . 
However, Cai and Choudhary established an equivalence between stan- 
dard signatures and the Pfafnans of certain matrices in [3] and [3], pro- 
viding a second definition. One consequence of their result is a description 
of the standard signatures as an algebraic variety: a function is a standard 
signature if and only if a certain set of quadratic equations evaluate to 
zero. This provides a third definition of a standard signature. 

Although the reader may think that three definitions is more than 
enough, we offer a fourth one. Our "new" definition is really a consequence 
of the Pfaffian definition, but it seems to highlight different properties 
than the other definitions. Our definition is recursive, i.e. we define n-bit 
standard signatures in terms of (n — l)-bit standard signatures. Here are 
some of the conclusions we draw: 

• If we are operating over a finite field, we can count the exact number 



2 



of n-bit standard signatures. We can also calculate the asymptotics 
for large n. Over F2 and F3, the number of odd parity standard sig- 
natures coincides with the number of n-dimensional self-dual codes. 
(See Subsections 13. II 13.21 and 13.71 respectively.) 

• It is known that any n-bit standard signature can be represented 
by a planar matchgate with at most 0(n 2 ) nodes. We construct a 
matching lower bound showing that there exist standard signatures 
that require at least Q(n 2 ) nodes to encode as a planar matchgate. 
(See Subsection 13.31 ) 

• Suppose we are given an n-bit function and we would like to de- 
termine if it is a standard signature. The naive approach takes 
0(n2 2n ) steps; using recursion and some structural properties, we 
can improve this bound to 0(n2 n ) steps. (See Subsection 13. 41 ) 

• Suppose we are working over a finite field and we select an n-bit 
standard signature / uniformly at random. We can calculate the 
expected sparsity of /, i.e. Pr[/(x) 7^ 0]. (See Subsection 13. 51 ) 

The paper is structured in two halves. In the first half, Section [2l we 
present the four different definitions of a standard signature and a few 
lemmas. In the second half, Section [3] we illustrate various corollaries 
of the recursive definition. Subsections 13.61 and 13.71 are more speculative 
in nature. We also include two appendices: Appendix [A] lists the general 
form for a normalized 6-bit standard signature, and Appendix iBlillustrates 
one method of building recursion into planar matchgates. 

2 Definitions 

Let V = {0, 1} be the field with 2 elements. We will be considering 
functions from V" — ► F, where F is an arbitary field. We refer to these as 
n-bit functions. (Other authors would call them n-arity functions.) Given 
x £ V", we often expand it in bits as x = xi • • • x n . 

To keep our notation saner, if a is a bit string and we remove a bit 
from it, we will write a. In a similar vein, given a function / : V n — > F, 
we can fix the last bit and define a new function f : V n ~ x — + F as 

/ Q (xi ■ • ■ Xn-l) = f(xi ■ ■ ■ X n -i0) 

and 

■ • ■ X„_l) = f(xi ■ ■ ■ !C»-ll) 

Let ei G V n be the string all of whose bits equal zero except for the 
i-th bit. Also, for any two n-bit strings x and y, let x + y represent the 
bitwise XOR of the two strings. 

Given £ V" , let \x\ be the Hamming weight of x, i.e. 

\x\ — Xl + X2 H + X n 

We define the partial Hamming weight as follows: 

k 

\x\j = Xi 
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Note that \x\" = \x\. If k < j, define |a:|* = 0. 

If f(x) = for all x, we call / the constant zero function, and write 
/ = 0. We refer to other functions as non-zero functions, or write / ^ 0. 

We can interpret the input either as an n-bit string, or as (the binary 
representation of) an integer in the range [0,2™ — 1]. Using the integer 
representation, we can specify a function / : V™ — + F by listing its outputs 
(i.e. its "truth table"). That is, / is fully determined by the ordered list 

(/(0),/(l),/(2),...,/(2"-l))GF 2 " 

Viewed as elements of F 2 , functions form a vector space over F: we can 
add together two functions, and we can multiply them by scalars in F. 

We say that a function / : V n — > F has even parity if all odd weight 
codewords are sent to zero, that is 

if |x| = 1 mod 2 then f(x) = 

If / has even parity and is not the constant zero function, then we say 
that / is strictly even parity. We can define (strictly) odd parity functions 
in the same way. Note that the constant zero function is the unique n-bit 
function that has both even and odd parity. 



2.1 Standard Signatures via Planar Matchgates 

In this section, we will define a class of functions, the standard signatures, 
in terms of certain graphs and perfect matchings. 

A planar matchgate over F is a planar embedding of a planar graph G 
with weighted edges Wi,j € F, along with a set of special "input/output" 
nodes vi, v n on the outer face of the graphQ We label the index of each 
Vi consecutively; that is, if we start at node Vi, and proceed in an anti- 
clockwise direction around the outer face, the next input/output node we 
encounter is v i+1 . 

We give an example below where F = R. The small numbers are the 
edge weights, the large numbers are the labels of the input/output nodes. 
Two of the outer nodes are not input/output nodes (and thus are not 
labelled) : 




'In a more typical definition, as in |13l . the input/output nodes are divided into distinct 
sets of "input" and "output" nodes. However, as long as we restrict our attention to the 
standard basis, that distinction is irrelevant, so we skip it for this paper. 
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A perfect matching is a collection of edges E such that every node 
is adjacent to exactly one edge in E. The weight of a particular perfect 
matching is the product of the weights of the edges in E. Following 
Valiant, we will define PerfMatch(G) to be the sum of the weight of every 
perfect matching in G (or zero if there are none.) In other words, 

PerfMatch(G) = ^ H w i.i 
e (i,j)eE 

Next, specify a vector x G {0, l} n . If the i-th bit of a; is a one, then 
suppose we remove node Vi and all of its adjacent edges from G. This 
produces some subgraph, which we will call G x . We can now define a 
function / : {0, l} n — > F by 

f(x) = PerfMatch(G^) 

The set of functions that can be described in this fashion (for some G) 
form the n-bit standard signatures over F. 

Given a weighted planar graph G' , it is possible to calculate PerfMatch(G') 
in time polynomial in the number of nodes using an object called a Pfaf- 
fian. This result was proved by Fisher, Kasteleyn and Temperley in 1961 
(see [8] for a survey); this is sometimes called the FKT Theorem. We will 
examine PfafHans in greater detail in Subsection 12.31 

We will need some notation to describe various sets of standard signa- 
tures. First, let A n be the set of n-bit standard signatures. (The set A n 
depends on F of course, but we will treat F as constant, so we will sup- 
press the extra notation.) We can partition A„ into three disjoint subsets, 
based on the parity of the function: 

a _ .odd . . .even . . ,0 

where A^ dd consists of the strictly odd parity standard signatures, A*^ en 
consists of the strictly even parity standard signatures, and A% is a one- 
element set consisting of the constant zero function. 

We will find it useful to normalize the standard signatures. Let us 
define a normalized standard signature as a standard signature / where 
f(0 ■ ■ ■ 0) = 1. We let B n be the set of normalized standard signatures. 
Note that all the elements of B n are strictly even parity[f| 

2.2 Basic Lemmas 

Before continuing with our definitions, we mention a few lemmas that we 
will find useful later. 

Lemma 1 If f = then f is a standard signature. 

Proof: Given any n-bit planar matchgate, we can add two more nodes 
and an edge between them of weight 0; the resulting standard signature 
is identically zero. □ 

For n = 1, we can write down A° dd and A\ ven explicitly. We will state 
it as a lemma for future reference. 

2 It might seem more natural to define a function as normalized if /(l • • • 1) = 1. However, 
the parity would change as a function of n; our definition makes the parity of B n even for all 
n. 
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Lemma 2 We can characterize the 1-bit standard signatures over any 
field F: 

Af d = {/ € V - F | /(O) = and /(l) / 0} 

A e,en = {J £ y ^ F | = g ^ /(Q) + Q} 

A = {feV^W | /(O) = and /(l) = 0} 

Lemma 3 By flipping a fixed input bit, we can construct a bisection be- 
tween strictly even and strictly odd standard signatures. 

PROOF: Suppose we have a planar matchgate and node v is labelled 
as the i-th input /output node. Suppose we add a new node v' , an edge 
between v and v' , and we relabel node v' as the i-th input/output node. 
If f(x) is the standard signature of the original planar matchgate, then 
f(x + ei) is the standard signature of the new planar matchgate. Note that 
f(x) and f(x + e,) have opposite parities. Since this operation (flipping 
the i-th bit) is invertible, we have established our bijection. □ 

Next, we let us examine normalized functions more carefully. Normal- 
ization preserves the quality of being a standard signature: 

Lemma 4 Suppose that f : V n — > F and there exists x such that f(x) = 
(3^0. Let 

g{x)=f3- 1 f{x + x) 

(Note that g{Q • • • 0) = 1.) Then f is a standard signature if and only if g 
is a standard signature. 

Proof: Suppose / is a standard signature and consider a planar 
matchgate for it. Consider the n input/output nodes. If Xi = 1, add 
a new edge and a new node to input/output node i. Move the i-th in- 
put/output node to the new node. This has the effect of switching the 
value of the i-th input bit. Finally, add two new nodes with an edge 
between them, and weight the edge by /3 _1 . The standard signature of 
the resulting planar matchgate calculates g. On the other hand, given a 
planar matchgate for g, we can repeat the process (using f3 instead of /3 _1 ) 
and build a planar matchgate for /. Therefore, / is a standard signature 
if and only if g is. □ 

In this paper, we are interested in decomposing standard signatures 
recursively. Recall that / and f l are obtained by fixing the last bit of a 
function /. We will repeatedly use the following fact: 

Lemma 5 If f is an (n + l)-bit standard signature, then f and / i are 
standard signatures. 

Proof: Consider a planar matchgate for /. Let v be the (n + l)-st 
input/output node. Consider a new planar matchgate that is identical, 
except that v is no longer labelled as an input/output node. This planar 
matchgate calculates / ; if we add a new node v' and a new weight one 
edge between v and v' , the resulting planar matchgate calculates / □ 
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2.3 Standard Signatures via Pfaffians 

The determinant of a matrix over a field F is a polynomial in the entries 
of the matrix. In the case of a strongly skew-symmetric n x n matrix M, 
this polynomial happens to be square, and the square root is called the 
Pfaffian. (We will define the Pfaffian more formally in a moment.) If we 
remove a set of rows and matching columns from M and calculate the 
determinant, we produce an object called a principal minor; there are 2™ 
principal minors. We can think of this operation (converting a matrix into 
one of its principal minors) as a function from V" — > F, where the i-th 
bit of the input tells us whether or not to delete the i-th row and column. 

Suppose, instead of taking the determinant of these submatrices, we 
take the Pfaffian. This will give us another function / : V" — > F, a sort 
of square root of the principal minors. In [3] and [4], Cai and Choudhary 
prove that / is a normalized standard signature; even more amazingly, 
as we let M vary over all strongly skew-symmetric matrices over F, we 
produce all the normalized standard signatures. 

We now state the previous facts and observations more formally. Let 
m(i,j) be the entry of M in the i-th row and j-th column. A matrix M is 
strongly skew-symmetric if m(i,j) = —m(j,i) for all i,j, and m(i,i) = 
for all i. (Strong skew-symmetry only differs from skew-symmetry when 
the field has characteristic two.) Note that the set of strongly skew- 
symmetric matrices can be viewed as ]p n (™- 1 )/ 2 ) since we can determine 
M by specifying n(n — l)/2 entries. 

The Pfaffian of an n x n strongly skew-symmetric matrix M is defined 
as zero if n is odd, and one if n = 0. If n — 2k is a positive even number, 
then we define the Pfaffian of M as follows. Suppose we pair up all the 
numbers between 1 and n, producing k pairs. We can encode such a 
pairing with a permutation that has the following two properties: 

tt(1) < tt(2), tt(3) < tt(4), 7r(n - 1) < ir(n) (1) 

and 

tt(1) < tt(3) < tt(5) < ■ • ■ < ty{ti - 1) (2) 

We then view (n(2i — 1), 7r(2i)) as paired numbers for i = 1, k. 

Let e,r be the sign of the permutation, i.e. t m = 1 if we can produce n 
from the identity permutation by composing an even number of transpo- 
sitions, and e w = — 1 otherwise. Then 

fc 

Pf(M) =J2^ J[ m « 2 j - l),*(2i)) 

t 3=1 

where the sum runs over permutations n satisfying the inequalities in 
Formulas [T] and [5] 

There is an alternate definition of that can be useful. Suppose that 
we have two pairs of integers i < j and k < I, and suppose that i < k. We 
say that the two pairs overlap if i < k < j < I. Suppose we consider all 
the pairs defined by tt. If there are an odd number of overlapping pairs, 
then tic — — 1; otherwise, e n = 1. 
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For x — (xi ■ ■ ■ x n ) G V n , let M x be the submatrix of M obtained by 
removing row i and column i from M if Xi = 0. Then define /a/ : V 1 — ► F 
by 

/ w (a!)=Pf(M,) 

Cai and Choudhary showed that the set of such functions are precisely 
the normalized standard signatures. Let us state this result formally. 

Theorem 1 (Cai and Choudhary) Let M be the set of strongly skew- 
symmetric n x n matrices over a field F. Then 

{fit | M e M} = B n 

Proof: See [3] and g|. □ 

There is a common method of calculating a determinant by recursively 
combining minors. We mention a Pfaffian version of the same thing. 

Lemma 6 Let M be an (n+1) x (n+1) strongly skew- symmetric matrix. 
Let x = I-- - 1 G V n+1 . Then 

Pf(M) = Pf(M £ ) (3) 

n 

= ^(-lJ'-'roftn + lJJ^Afa+ai+en+J 

8=1 

Suppose that there are s non-zero bits in x, and let pi,...,p s be the 
positions of those bits, in order. Then 

3 

Pf(M x ) = £(-l) i_1 m(pi,n + l)i^M <B+ap4+(lB+1 ) (4) 

i=l 
n 

= J] a;i (-l) |a;| r 1 m (p,,n + l)P/(M I+ei+e „ +1 ) (5) 

i=l 

Proof: Equation |4] is standard (see, e.g. [6]); it can be proved by 
using the "overlapping pairs" definition of e^. 

Equation [3] follows by simply applying Equation U to the submatrix 
defined by the rows and columns specified by x. 

Equation [5] follows from Equation [4] since the terms in the sum cor- 
responding to irrelevant rows are zeroed out by the Xi terms, and the 
(— term alternates signs at every non-zero bit in x. □ 

For a fixed n, we can expand the Pfaffian as a multivariate polyno- 
mial and write down a parameterized expression for the general form of 
a normalized standard signature. The number of terms in the longest 
polynomial is of size 0(vn!), but for small n this size is manageable. To 
see the case of n — 6 bits, please refer to Appendix [XI 

2.4 Standard Signatures via Algebraic Varieties 

The Pfaffian definition of a standard signature above is quite powerful, and 
illuminates other interesting structural features of the standard signatures. 
It allows us to describe the set of n-bit standard signatures as an algebraic 
variety in F 1 - 2 '. In other words, / is a standard signature if and only if 
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the set of outputs /(0 • • • 00), /(0 • ■ ■ 01), /(I ■ • ■ 1) satisfy a collection 
of polynomial (in fact quadratic) equalities. 

We proceed with this alternate definition. A function / : V" — > F is 
a standard signature if and only if it satisfies the following two classes of 
constraints: 

• First, there is a Parity Constraint: f must be an even parity or odd 
parity function. 

• Second, there are the Matchgate Identities, also known as the useful 
Grassmann-Pliicker equations. Let p be an n-bit string. (The "p" 
stands for "position vector".) Let L — \p\. Let pi,..., pi be the 
positions of the L non-zero bits of p, in order. Then for all a,p £ V", 
the following equation holds: 

L 

j3(-l)7(a + e f.)/( Q + e Pi +P) = 

i=l 

The equivalence of these constraints with the Pfafnan definition of a stan- 
dard signature was proved by Cai and Choudhary in [3] and [4]. We can 
now prove a few more lemmas. First, remember that polynomial images 
of affine spaces are not necessarily algebraic varieties (see e.g. the exer- 
cises in Chapter 3, Section 3 of [5]). In the case of normalized standard 
signatures, however, we are lucky: 

Lemma 7 The set B n of normalized standard signatures is an algebraic 
variety isomorphic to ]p n ( n - 1 )/ 2 , 7/ F is an infinite field, then B n has 
dimension n(n — l)/2. 

Proof: Since A n is an algebraic variety, we can intersect it with 
/(0 • • • 0) = 1 and conclude that B n is an algebraic variety. 

Now, we turn to the isomorphism. First, since the Pfafnan is a polyno- 
mial in the entries of the matrix M, there exists a map K : ]p n ( n ~ 1 )/ 2 ^ 
F 1 - 2 ' that is surjective on B n . Next, fix a < b < n. Suppose that 
x = (xi ■■•£„), where Xi = 1 iff i = a or i = b. Then note that 
Pf(Mf) = m(a,b). Therefore, if we project the coordinates correspond- 
ing to weight two codewords, we get a map K' : B n -> F n(n - 1)/2 that 
recovers M. Note that K' o K is the identity in F n(n " 1)/2 , and K o K' is 
the identity on B n . Therefore, B n is isomorphic (as an algebraic variety) 
to ]p n ( n - 1 )/ 2 ] anc i hence they share the same dimension. If |F| is infinite, 
F n(n-i)/a is n ( n _ dimensional. □ 

Suppose we take a matchgate G and let the edge weights vary. Each 
choice of edge weights will define a standard signature. Let Jg be the 
collection of such standard signatures, viewed as a subset of F^ 2 '. Then 
the following lemma holds: 

Lemma 8 Assume that our field F is infinite. Suppose that G is an n-bit 
planar matchgate. Suppose that the underlying planar graph of G has X 
nodes and E edges. Then the set Jg is contained in an algebraic variety 
of dimension at most E. 

Proof: Given a weighted X node planar graph, we can calculate 
the sum of all its weighted perfect matchings using the FKT Theorem 
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(see [8]). This theorem expresses the sum as the Pfafnan of a particular 
X x X matrix M, namely a polynomial in the edge weights. 

If we consider all the 2 X principal submatrices of the planar graph, 
each one corresponds to removing or including a particular node in the 
graph (not just the input/output nodes). The underlying planar graph 
forces some of the entries of the matrix to be zero. If we ignore that 
restriction, we have exactly described the set of normalized standard sig- 
natures on X bits. From Lemma [7] this object is an algebraic variety in 
F 1 - 2 We will now restrict this variety to recover Jg- 

For each edge ejj that does not appear in the underlying graph, we 
set matrix entries m(i,j) = m(j,i) = 0. This results in an intersection of 
algebraic varieties, so adding these constraints for all the missing edges 
gives us another algebraic variety P. Since P is parameterized by E 
variables over F, it follows that dim(P) < E. 

We are interested in projecting P down to the 2™ variables (where 
we are only allowed to remove rows and columns corresponding to the 
input/output nodes from M). We can now use polynomial implicitization 
(see Chapter 3, Section 3, Theorem 1 of |5J to find the smallest variety P' 
in F 1 - 2 ' containing the projection. (Note that this theorem assumes that 
F is infinite.) We construct P' by eliminating variables (i.e. intersecting 
ideals), so dim(P') < dim(P) < E. This establishes our theorem. □ 

2.5 Standard Signatures via Recursion 

We will present a recursive definition of a standard signature which makes 
no explicit reference to Pfafnans or planar matchgates. We begin by 
defining a new set of functions. Suppose we are given a non-zero function 
/ : V n — > F and we choose a base point x such that f(x) ^ 0. (We will 
see in Corollary [T] that the choice of base point is irrelevant for standard 
signatures; for now, let us choose x to be the lexicographically smallest 
x such that f(x) ^ 0.) Let us define the shift basis functions s{ (where 
i = 1, n) as 



Next let us define the shift set as the set of functions formed by linear 
combinations of the shift basis functions, i.e. 



Note that the elements of the shift set all have the opposite parity as /. 
We point out two properties of the shift set. 

Lemma 9 The shift basis functions for f, viewed as vectors over F^ 2 \ 
are linearly independent ( i. e. they actually form a basis for §/)■ Therefore, 
Sf can be viewed as an n dimensional subspace o/F' 2 '. 

PROOF: Notice that 
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so s((x + Cj) is non-zero if and only if i = j. It follows that the s[ are 
linearly independent, and hence that the shift set Sf has dimension n. □ 
We can now introduce our new definition: 

Theorem 2 The set of normalized standard signatures can be defined 
recursively: 

B n+1 = {/ : V n+1 -> F | / Q G B n and £ G S/J (6) 

The set of all strictly odd or strictly even standard signatures can be sim- 
ilarly defined: 

A° n % = {/ : V n+1 - F I ^ e A° n dd and £ G S^ } (7) 
U {/ : V n+1 - F | / Q = and £ G A^ en } 

A^+T = {/ : - F | / Q G A^ en and / i G S/ o } (8) 

U {/ : V n+1 -H- F | / o = and £ G 

PROOF: We start by proving Equation[6] First, Lemma [5] shows that 
if / is a standard signature, then / is a standard signature. 

So, assume that f is a standard signature. Recall, from our Pfaffian 
definition, that for any normalized standard signature / : V n+ — ► F, 
there exists some strongly skew-symmetric matrix M such that 

f(X! •• -Xn+l) =Pf(M« 1 ... 1 r B+1 ) 

Now, suppose that bit x n +i = 1, and let a; = au • • • x n . 
Recall Equation [S] 

n 

Pf(Af„) = ^ ^(-rjK^mfri, n + l)Pf(Jtf„ +<lt+art+l ) 
Expressing this in terms of our function /, this equation becomes 

n 

f(x) = ^ m(pi,n + l)f{x + e» + e n+1 ) 

i=i 

n 

= m(pf, n + 

i=l 

/ 

where s~° is a shift basis function (with base point ■ • ■ 0) . 
Finally, since the (n + l)st bit of x = 1, we can write 

n 

zoo = = X! m(i - n + 1)s ^° (£) 
i=i 

In other words, the set of valid / l is exactly Sf . In other words, 
Bu+i = {/ : V n+1 -F|/ o £B„ and £ G S/J 
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which establishes Equation [6] 

Next, let us turn to proving Equation [7] Consider / 6 where 
/ 7^ 0. Let £ = xi • • • i„+i G l/ n+1 such that /(a;) 7^ and ai„+i = 0. Let 
g(x) = (1/ f(x))f(x + x), i.e. / normalized around x. From Equation [6] 
we know that g is a standard signature if and only if g G S 9 . If we 
translate the elements of §> g by adding x to the inputs, notice that the 
resulting set is exactly $ / . tjsing Lemma [4] we can conclude that / is a 
standard signature if and only if / £ S; . This establishes the first half 
of Equation [7] 

On the other hand, if / G A n +i but / = 0, then /1 G A n . We know 
that fi C A n from Lemma [5] Conversely, given any /1 £ A n , we can 
construct a planar matchgate for / by adding a new disconnected node 
and labelling it as input/output node n + 1. This establishes the second 
half of Equation [JJ 

Equation [8] follows symmetrically to Equation [7J □ 

Theorem [2] gives us a recursive procedure to determine if an n-bit 
function is a standard signature. If the function is the constant zero 
function, it is a standard signature. Otherwise, we can normalize it to 
a function /. We can now check if / G Sf a and if f Q G B n . The first 
condition can be checked by linear algebra, and the second condition can 
be checked recursively. 

Finally, we justify our earlier comment about the irrelevance of our 
choice of base point for normalization. 

Corollary 1 If g is a non-zero standard signature, then the set ffi 9 is 
independent of the choice of base point. 

Proof: Suppose we have a standard signature / where there exist 
two base points around which we can normalize / Q (i.e. there exist b 7^ c 
such that 6n+i = c n +i = 0, where f(b) 7^ and /(c) 7^ 0.) These 
different definitions of "normalization" produce two possibly different sets 
ffi/ and S' f . If we applied the proof of Theorem[2]to each case, we would 

—0 i_o 

conclude that / is standard signature iff f ^ g S/ iff f 1 G S'j . Therefore, 
Sf = Ss'f . Now, for any g G A n there exists an (n + l)-bit standard 
signature / such that / = g. Therefore, $ s is independent of the choice 
of base point. □ 

3 Consequences of Recursion 
3.1 Counting Standard Signatures 

Over a finite field F, there are only finitely many n-bit standard signatures 
for any fixed n. In other words, \A n \ is finite. The recursive structure 
described in Theorem [2] allows us to find a formula to count |^4n|- 

Corollary 2 If we are operating in a finite field F , where |F| = s, then we 
can calculate the cardinality of the set of normalized standard signatures, 
odd parity standard signatures, and general standard signatures: 

n-l 

\Bn\ = Y[ s* = s n{n - 1)/2 (9) 
1 = 1 
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a: 



\An.\ 



= (s-i)n( si+i ) 

n-1 

(s - 1) n ( s * + o 



1 + 2 x 



(10) 
(11) 



where we interpret the empty product as evaluating to one. 

Proof: We first consider Equation [5] For any f g B„, / i can be 
chosen freely from $/ Lemma [9] shows that S/ is n-dimensional, so 



regardless of which particular (non-zero) / we pick. If n > 1, then 



Theorem [2] implies that 



\B, 



n+l| 



{/ : V n+1 -F|/ o £B„ and / l G ffi £o } 



= IBJxs" 



Since |_Bi| = 1, Equation [5] follows by induction. 

Next, consider Equation 1101 If n > 1, then note that Equation [7] of 
Theorem [2] is a disjoint union of two sets. Therefore, 



1-4 



n+ll 



{/ : V n+1 - F | / () G < dd and £ G ffi/ o } 
U {/ : - F | ^ = and f_ ± e ^ST' 1 } 

{/ : - F | / Q G AT and £ G ffi/ o } 

+ | {/ : V" +1 - F | / o = and £ G jC""} 



I 4 odd | v Q n 4- I 4 odti | 

= (s n + l)\A° dd \ 

By Lemma [2] |j4J dd | = s — 1. Therefore, by induction, we have proved 
Equation [10] 

Finally, we turn to Equation HU By Lemma El \A n dd \ = \A n ven \. If 
we account for the zero function, we can conclude that 



\A r . 



= 1 + 2 x \A° 



1 + 2 x 



(s - 1) n ^ + 1) 



3.2 Asymptotics of |A n | 

If we want to evaluate \A n \ or \A^ dd \ 
in to Equations [10] or 1111 However, 
behavior for fixed s as ra grows. 



for small s and n, we can just plug 
we might also be interested in the 
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In order to study this regime, we will introduce the (partial) function 
7 : C — » C, where 

oo 

7w=n( i +( 1 /^) 1 ) 

i=l 

It is not a priori clear that 7 converges. However, if we expand in 1/x, 
then 7 is the generating function for the number of ways of partitioning 
a set into unequal parts. We can then use the following lemma: 

Lemma 10 If x G C lies outside the unit circle, then 7(1) converges. 

Proof: A proof can be found in p], Section 14.4. □ 
We are interested in integer values of x where x > 2, so 7(2;) will 
converge. We can now express the asymptotics of \A n \ more precisely. 

Theorem 3 Suppose we are operating on a finite field F of size |F| = s. 
Then 

A odd 

8 n(n-"l)/2 + l = ?(«) 

Therefore, the growth rate is 

\A° n dd \ = e ( s ™ ( "- 1)/2+1 ) 
\A n \ = e ( s " ( "- 1)/2+1 ) 

Proof: From Theorem [2] we can write 

n-l 

\K dd \ = (s~l)]l(s' + l) 

8=1 

n-l 

= (s - 1) s™'™- 1 )/ 2 7J (V + 1) / s ' 
1=1 

n-l 

= ( S _l) s "("-D/ 2 JJ (l + l/( fl «)) 



Therefore, 



I AOdd\ I ytoddi 

lim |A " = Km l A " 1 

n^oo s n(n-l)/2+l 

(s - l)s n ("- 1 ) 

OO 

= iim TT (1 + (i/ s y) 

n — ' 00 A A 

i=l 

= 70) 

It follows that \A° n dd \ = 9 ( s "("-i)/2+i). 

Since |A„| = 1 + 2|A° dd |, the results on |A n | follow. □ 
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In practice, the product form for 7 converges somewhat slowly. How- 
ever, there is a trick for evaluating 7 more efficiently. Recall Euler's 
Pentagonal Formula (see Q]): for any \a\ < 1, 



IK 



1 ' 

1 — a 



1— — 00 



where = (3i 2 - i)/2. The sum formulation converges much more 

rapidly. If we let a = 1/s, we can write 



i=l 

= TT^n TV ( 13 ) 

y°° (~i)v 2 " (i) 

"V 55 (-i)v-w 

z ^i— — 00 v / 

Since the products are infinite, the step from Equation [12] to Equation 1 131 
requires justification, but it is straightforward. 

It now becomes computationally simple to calculate 7(s) to high pre- 
cision; here is a table for a few values: 



8 = |F| 


7 (s) 


2 


2.384231 


3 


1.564934 


4 


1.355910 


5 


1.260501 


7 


1.170149 


8 


1.145129 


9 


1.126565 



So, for instance, for large n, there are about 

27(2)2 n(n ~ 1)/2+1 = 4.768 x 2 n( ™- 1)/2+1 

n-bit standard signatures over F2. These calculations will also enable us 
to calculate the table of probabilities in Subsection 13.51 



3.3 Bounds on Planar Matchgate Sizes 

If we are given an n-bit standard signature, by definition there exists some 
planar matchgate that computes it. However, it is not a priori clear how 
large the planar matchgate must be to simulate the standard signature. 
An upper bound of size 0(n 4 ) on the number of nodes and edges has been 
constructed by Li and Xia (see Theorem 3.3 in [9]), and in Appendix iBl 
we mention a recursive construction that would require 0(n 3 ) nodes and 
edges. However, these bounds are both beaten by Cai and Choudhary's 
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original constructions in [3] and [4], which establish an 0(n 2 ) upper bound 
on the number of nodes and edges required 

In this subsection, we present a matching lower bound showing that 
the 0(n 2 ) upper bound is tight. 

Theorem 4 There exist standard signatures that can only be represented 
on graphs with at least Q(n 2 ) nodes. More specifically, there exist standard 
signatures that require X nodes, where 

X + 0(log(X)) > n 2 /16.015 - 0(nlog(n)) 

Proof: First, suppose that F is an infinite field. Suppose we choose: 

• an unweighted planar graph with at most X nodes, where X > n, 
along with 

• some planar embedding for the graph, and 

• a choice of n input/output nodes on the outer face. 

We will call such an object a stripped matchgate, since we have stripped off 
the edge weights. If we take a stripped matchgate and add edge weights, 
we get a planar matchgate. 

We will consider two planar embeddings to be isomorphic if they pro- 
duce the same set of nodes on the outer face, in the same order. Note 
that there are only finitely many non-isomorphic planar embeddings for 
any graph. Since the other properties of a stripped matchgate are also 
finitary, it follows that that there are only finitely many stripped match- 
gates with non-isomorphic planar embeddings. Let Q be a set of planar 
matchgates representing each of the possible stripped matchgates with 
non-isomorphic planar embeddings; our comments above show that \Q\ is 
finite. 

If G is a representative planar matchgate then recall from Subsec- 
tion 12.41 that Jg is the set of all standard signatures sharing the same 
stripped matchgate. 

Suppose our graph has E edges. Since our graph is planar, E < 2>X. 
Lemma [8] shows that Jg is contained in an algebraic variety Pg with 
dim(Po) < E < 3X for any G. Therefore, the set of standard signatures 
definable on graphs with at most X nodes is contained in a finite union 
of varieties: UgssPg- This finite union is itself a variety; since each 
component has dimension at most E, the union has dimension at most 
E < 3X. 

However, recall from Lemma [7] that B n is also an algebraic variety, 
and dim(B n ) = n(n - l)/2. Therefore, if 3X < n(n - l)/2, then 

dim(B„) = n(n - l)/2 > 3X > dim^ceS-Pc) 

Therefore, 

B„ % Ucesffc 

3 In fact, if we apply the switch planar matchgates in Appendix [B] to Cai and Choudhary's 
construction, we can produce a planar matchgate for an n-bit standard signature on any field 
that uses at most 20n(n — 1) + n + 2 nodes. For fields of characteristic two, ln{n — 1) + n + 2 
nodes suffice. 
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and hence 

B n % UggsJg 

Therefore, there exist standard signatures in B n (and thus A n ) that re- 
quire at least n(n — l)/6 = n 2 — 0(n) = Q(n 2 ) signatures to represent 
them. 

Next, suppose that F is a finite field. Roughly speaking, we will repeat 
the argument above, but the finiteness of the number of planar matchgates 
is no longer sufficient- we need to count the number of planar matchgates 
explicitly, which is a more delicate operation. 

Suppose we consider a planar matchgate with underlying (weighted) 
graph G on X nodes. We are going to represent the planar matchgate as 
a planar graph on X + 1 nodes with certain special labels. We proceed as 
follows: we take G and add a new node v. We label this node as "extra". 
We add an edge from v to each of the input/output nodes, and give the 
new edges weight one. We label each of the n input/output nodes by a 
distinct number from 1 to n, namely the number of the node. 

Let Tx be the set of labelled planar graphs with a node labelled "ex- 
tra", which has n neighbors, each labelled with a distinct number between 
1 and n. (So the elements of Tx are graphs with X + 1 nodes.) Note 
that Tx is larger than the set of planar matchgates, because we are not 
enforcing the input/output nodes to be on the outer face of the graph. 
However, every different X node matchgate maps to a distinct one of these 
labelled planar graphs, so by counting \Tx\, we will get an upper bound 
on the number of standard signatures that can be represented with X 
node graphs. Note also that we are counting planar graphs, not planar 
embeddings (a different embedding of the same matchgate will produce 
the same standard signature, assuming that the input/output nodes are 
still on the outer face, and we orient the embedding to make the node 
labels run anti-clockwise.) 

The reader may wonder how we can add the "extra" node v and its 
edges and be confident that our graph remains planar. The input/output 
nodes all lie on the outer face of some planar embedding; therefore, it 
is possible to place a node in the outer face and attach it to all the in- 
put/output nodes without crossing any edges. 

Suppose we are given a planar matchgate with X — 2Y nodes. Then 
we can add disconnected 2-node subgraphs with edges of weight 1 at will 
without changing the standard signature. If we add Y of those subgraphs, 
we build a planar matchgate with X nodes. Therefore, all standard sig- 
natures representable on planar matchgates with X — 2Y nodes are rep- 
resentable on planar matchgates with exactly X nodes. 

Therefore, all standard signatures on planar matchgates with at most 
X nodes can be represented by unique elements of Tx or Tx-i- 

We now need to determine the size of Tx ■ Planarity is a very restrictive 
condition on a graph; there at most 2 5 007X+O ' log x ' planar graphs with 
X (unlabelled) nodes (see [7]). There are at most 3X edges on a planar 
graph, so we have at most (s — 1) 3X labellings. There are X possible 
choices for the "extra" node. The neighbors of the extra node are all 
labelled by distinct numbers between 1 and n, so there are n! possible 
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numberings. Therefore, 

\T X \ <(X + l)(n!)(a - 1 f^+^2 5 - 007(x+1 '> +o ^ (x+1)) 
Therefore, 

\T X \ + \T X ^\ < 2(X + l)(n!)( S -l) 3(x+1) 2 5 - 007(x+1)+o(log(x+1)) 

Bringing all the terms into the exponent and absorbing extraneous ones 
into the 0(log(X)) term, (and remembering that n\ = 2 ™ lo S2("/=)+o(i°g("))) i 
we can rewrite this as 

\Tx\ + \T X i| < 2 5smx+3X 1 °g2( s - 1 )+« 1 °g2(™/ e )+o(iog(x)) 
However, we know that there are 



1 + 2(s - 1) J]V + 1) > s n(n - 1)/2 = 2 n(n - 1 



)(log 2 ( S ))/2 



n-bit standard signatures. Therefore, in order to express all these standard 
signatures, we need X to be at least large enough that 

25.007X+3X log 2 (s-l)+nlog 2 (n/e) + 0(log(X)) 2 lo S2 (s)n(n- 1) /2 

Comparing exponents, we therefore need 

5.007X + 3Xlog 2 (s- 1) +nlog 2 (n/e) + 0(log(X)) > log 2 (s)n(n- l)/2 
Replacing (s — 1) by s on the left hand side and solving for X, we get 

nln — 1) — 2 " log 2("/ e ) 
X + °^ X » > 6 + (10.014/ SSk + 
So, there must exist some standard signature that requires at least 
n(n - 1) - " log2(x) 

6+( K,owiS(';S) +o ^<"> 

nodes. This lower bound is Q(n 2 ), so we have established the rough bound 
for the theorem. To obtain the specific bound, note that the denomina- 
tor is maximized when s = 2, at which point the denominator becomes 
16.014.... Conservatively rounding it up to 16.015 gives the result. □ 



3.4 Efficiently Detecting Standard Signatures 

Suppose we are given a function / : V n — » F, and we would like to 
determine if / is a standard signature. What is the complexity of deciding 
that question? 

First, let us find a lower bound. The function / has 2" inputs. Suppose 
that /(0 ■ ■ ■ 0) / 0. At the very least, we need to check that all the 2 n_1 
odd-parity strings map to zero. Therefore, deciding if / is a standard 
signature takes at least 

2"- 1 = n(2 n ) 
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steps to evaluate. 

But how should we actually verify that / is a standard signature? 
One reasonable approach would be to use the algebraic variety defining 
A n . Recall that / is a standard signature iff it satisfies the Parity Con- 
straint and the Matchgate Identities for every p, a G V n . We can verify 
the Parity Constraint by running through the output values once and 
checking for non-zero values, which takes 2" steps. For the Matchgate 
Identities, each equation has n terms, and there are 2" choices for both p 
and a. Assuming the Parity Constraint holds, we only need to check the 
Matchgate Identities for even parity p and a of opposite parity to /. This 
approach would take 

2 „ +n2 2(n-l) = Q^n^ 

steps to evaluateQ 

The recursive structure of the standard signatures allows us to use 
a much more efficient approach. The general outline of our technique 
is to assume that / is a standard signature. This assumption lets us 
recover a unique fingerprint for / by examining only a small subset of 
the output values. We then use this fingerprint to reconstruct an actual 
standard signature /'; this reconstruction takes n2" steps. Finally, / is 
a standard signature iff / = /', which we can check in another 2" steps. 
This approach takes only 

C>(n2 n ) 

steps to evaluate. We now analyze this process more carefully. 

Theorem 5 Suppose we are given a function f : V n — > F (that is, we are 
given a list of f(x) for all x G V n , sorted by x). Then we can determine 
if f is a standard signature in time 0(n2 n ). 

PROOF: We begin by determining if / is identically zero. This takes 
0(2 n ) steps; if / = then it is a standard signature, and we are done. 
Otherwise, we will discover a string x G V n such that f(x) 7^ 0. Let 
us normalize our function at x by constructing the new function g(x) = 
(1/ f(x))f(x + x). From Lemma[3] / is a standard signature if and only if 
g is, so we will henceforth focus on g. Constructing g takes another 0(2") 
steps. 

Suppose that we have a standard signature h. Recall from the Pfaffian 
definition of the standard signature that there is some matrix M such that 

h{x) = Pi{M x ) 

Let us use m(i,j) to represent the entry of M in the i-th row and j-th 
column. Suppose that x has Hamming weight two, i.e. x = e; + ej, where 
i < j. Then M x is a 2 x 2 matrix of the form 

( m(i,j) \ 

\ -m(i,j) J 

4 If our function / happens to be sparse, with only k non-zero values, then we only need 
to check at most n(^j Matchgate Identities. Therefore, we can determine if / is a standard 

signature in only n 2 steps. 
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In particular, 



h(x) = Pi(M x ) = m(i,j) = -m(j,i) 

In other words, the n(n— l)/2 weight 2 codewords completely specify M. 

So, given g, let M be the matrix determined by the value of g on all the 
weight-two codewords. Now that we have M, let us construct a standard 
signature h from it. We do this recursively. Define /i 1 (0) = 1, h (1) = 0. 
Define 

f /i/- 1 ^!---^-!) if Xj =0 

ft J (a:i ■•■%) = 4 ™_i 

I Li=i -"hmK if % = 1 

where sf 3 is a shift-basis function of ft, 3-1 . Recovering /i n takes 

n 

^(i - 1)2 <_1 = (n - 2)2 n + 2 = 0(n2") 

i=2 

steps. From our recursive definition of the standard signatures (cf. the 
proof of Theorem [5}, it follows that h n is a standard signature, and by 
construction h n (x) = g(x) for all weight-two codewords x. 

Since each standard signature defines a unique M, g is a standard 
signature if and only if g = h n . We can compare their outputs in 2 n 
steps; they are identical if and only if g (and hence /) is a standard 
signature. □ 



3.5 Expected Sparsity 

How large is the support of a typical standard signature? That is, if we 
choose / G A n "randomly" , what fraction of the entries are non-zero? To 
put it another way, if we view / as a vector in F' 2 how sparse is the 
vector? 

For infinite fields, it is not clear which measure we should use to select 
our function /. But if F is a finite field, it seems natural to choose / 
uniformly at random from, say, A n ven , and the problem is well-defined. It 
turns out that we can prove a slightly stronger result- we can calculate 
the expected sparsity for each individual input bit. 

Theorem 6 Assume we are operating over a finite field F of size s = |F| . 
Suppose we choose f G A„ ven uniformly at random, and select any fixed 
even parity n-bit string x. Then 



Pr(/(f ) + 0) 



(14) 



The analogous result also holds for strictly odd parity standard signatures. 

Proof: Let C e n ven C A e n ven such that for any g G C n ven , g(0 ■ ■ ■ 0) ^ 0. 
Note that if we take an element of / and divide its outputs by /(0 • • ■ 0), 
we obtain a normalized standard signature in B n . Each element of B n is 
the image of exactly s — 1 elements of C n - Therefore, 



\C n \ = (s-l)\B n \ = (s-l)Y[s i - 1 
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Now, if we choose / G uniformly at random, notice that 

Pr[/(0---0)/0]=Pr[/GCr en ] 
Since we are selecting functions uniformly, it follows that 



Pr[/(0"-0)^0] 



\A c n ven \ 

(«-i)nr=i 1 ( i + s< ) 



i=l 

71-1 



+ s l 



J-l 1 + S" 8 

=1 

n-1 

11(1+-" 



Suppose we take the classes of functions above and add x to their 
inputs (i.e. we translate them by x). The sizes of the sets, and thus the 
probabilities, do not change. Therefore, we can conclude that for any 
fixed x, 

"n-l 

p r [/(f)/o]= n( i+s ~ 

_i=i 
as desired. □ 

As a simple consequence, we can calculate the expected sparsity: 
Corollary 3 If we choose non-zero f € A n uniformly at random, then 



Expected Sparsity 



E 



\{x\f(x)*Q}\ 



2 n 



Proof: 



Expected Sparsity 



\{x\f(x)^0}\ 



2 n 



±E 

2 n 



2" 
2" 



J2 + 0) 

x£V n 
n-l 

,»=1 

n-l 
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as desired. □ 

For a fixed field of size s, the probability converges as n 
lim (Expected Sparsity of A^ en ) 

n — >oo 

= lim (Pr(/(0-.- 0)^0)) 



lim 

71 — >00 



n-1 

l[(l + s 



(See Subsection 13.21 for details and computational issues.) We include a 
table of these limiting probabilities for a few small fields. For comparison, 
we also list the expected sparsity of an arbitary function g : V n — > F 
selected uniformly at random, which equals 1 — (V s )- 



a = |F| 


1/ 7 ( S ) 


1-(1/ S ) 


2 


0.419422 


0.5 


3 


0.639005 


0.666666 


4 


0.737512 


0.75 


5 


0.793335 


0.8 


7 


0.854592 


0.857142 


8 


0.873264 


0.875 


9 


0.887654 


0.888888 



3.6 Expressiveness of Holographic Algorithms 

If our base field F is finite, then there are only a finite number of n-bit 
standard signatures. In addition to being of intrinsic interest, the number 
of standard signatures gives us some intuition about the expressiveness 
of a holographic algorithm: the more signatures, the more expressive the 
algorithms could possibly be. We have found it instructive to compare 
the relative sizes of a few classes of functions. 
Let |Fj = s. 

• The number of functions from V n to F: 

s (2") 

• The number of functions from V n to F with even or odd parity: 

2 S ( 2 "- 1 ) - 1 

• The number of standard signatures: 



\AJ = 1 + 2 x 



= e i 



The number of symmetric realizable functions (assuming the char- 
acteristic of the field is odd, and the characteristic doesn't divide n) 
on any basis of size 1 (not just the standard basis): 

s ( s -i) 3 ( s + 3) + i = e( s 5 ) 

See Theorem 4.2 in [5] for more details. 
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So, based only on cardinality, we could argue that general functions are 
exponentially more expressive than standard signatures, which, in turn, 
are exponentially more expressive than symmetric realizable functions. 

3.7 Cardinality of Self-dual Codes 

It would be extremely interesting to find an isomorphism between the n- 
bit standard signatures and other, better studied mathematical objects. 
Having an exact count of the number of standard signatures over various 
finite fields can facilitate this hunt; if an isomorphic object exists, it will 
necessarily have the same cardinality. Do any such objects exist? 

We can find an example in the world of self-dual codes. Recall that 
over Fa, \A^ dd \ = Y["=i (2 s + !)■ Surprisingly, this equals the number of 
dimension n self-dual codes over F2 (i.e. self-dual codes in F§ n ). Moreover, 
over Fa, it turns out that \A^ dd \ = 2U"^(3 i + 1) equals the number of 
dimension n self-dual codes over F3! See Chapter 3 of [11] for these results; 
consider "type q E " self-dual codes. 

When discussing a self-dual code, we implicitly assume some particular 
inner product; for the two results above, we used the Euclidean inner 
product. Frustratingly, if we continue to use the same inner product, the 
cardinalities diverge for all other finite fields. The agreement over F2 and 
F3 seems like a fairly spectacular coincidence, though. 

How can we circumvent this divergence? We might look for a better 
inner product, but no obvious candidates suggest themselves. (See [10] 
for a thorough examination of many alternate possibilities.) If we stick 
to the Euclidean inner product, though, we can match the cardinalities 
with a little normalization gimmick. For any / £ A^f d , since / ^ 0, there 
exists a lexicographically smallest x G V n such that f(x) 7^ 0. Call a 
standard signature semi-normalized if f(x) = 1. Let H% be the set of 
semi-normalized standard signatures. Let #SD(F, n) be the number of n 
dimensional self-dual codes over F with the Euclidean inner product. If 
|F| is even, it turns out that 

\Hn di \ = #SD(W,n) 

while if I IP I is odd, then 

\H° dd \ + \H^ en \=#SD(W,n) 

Although numerically surprising, the above observations do not suggest 
how we might actually construct an isomorphism between the standard 
signatures and the self-dual codes. Until we can build a non-trivial iso- 
morphism, these cardinality results remain only curiosities. 

A The Six-bit Normalized Standard Sig- 
nature 

Recall that a normalized standard signature is a standard signature / 
where /(0 • • • 0) = 1. Since / is an even function, we only need to specify 
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the output for even-weight inputs; all the odd-weight inputs evaluate to 
zero. 

As we discussed in Subsections 12,31 and 13.51 all the outputs can be 
expressed as polynomials in the f(x), for x with Hamming weight two. 
More generally, if x has Hamming weight 2k, then f(x) can be expressed 
in terms of f(x') where x' has weight 2k — 2. Each monomial term in 
a polynomial has coefficient e w = ±1. It is straightforward to show by 
induction on the weight of the input string that if \x\ = 2k, then there are 

monomial terms in f(x). 

Here is the set of polynomials for the six-bit normalized standard sig- 
nature. Note that if we fix the first bit as zero, we produce the general 
form for all the five-bit normalized standard signatures, and so forth. 
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A5,4 






/(011011) 




A5,l A4 : 2 


— A5 i 2A4,l 


+ As,4A2,l 


/(011101) 




A5,l A4,3 


— A5 I 3A4,1 


+ As,4A3,l 


/(011110) 




A5,2A4,3 


— A5 i 3A4,2 


+ As,4A3,2 


/(100001) 




A6,l 






/(100010) 




A6,2 






/(100100) 




A6,3 






/(loom) 




A6,l A3,2 


— A6,2A3,1 


+ Ae,3A2,i 


/(101000) 




A6,4 






/(101011) 




A6,l A4,2 


— A6.2A4.1 


+ Ae,4A2,i 


/(101101) 




A6,l A4,3 


— A6.3A4.1 


+ A6,4A3,l 


/(101110) 




A6,2A4,3 


— A6,3A4,2 


+ Ae,4A3,2 


/(110000) 




A6,5 






/(110011) 




A6,lA5,2 


— A6,2A5,1 


+ Ae,5A2,i 
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/(110101) = 


A6,l 


A 5 ,3 


— A6,3A5,l - 


- A6,5A3,1 


/(110110) = 


^6,2 


A 5 ,3 


— A6,3A5,2 ' 


- A6,5A3,2 


/(111001) = 


Ae,i 


A5,4 


— A6,4A5,1 - 


r~ A6,5A4,1 


/(111010) = 


A6,2 


A5,4 


— A6,4A5,2 " 


r A6,5A4,2 


/(111100) = 


A6,3 


As, 4 


— A6,4A5,3 " 


'- A6,5A4,3 


/(mm) = 


A6,l 


A5,2 


A4,3 — Ae.iA 


5.3A4.2 + 



— A6,2A5,lA4,3 + A6,2A5,3A4,1 — Ag^As^As,! 

+A6,3A5,l A4,2 — A6,3A5 J 2A4,1 + A6,3A5,4A2,1 

— A6.4A5,! A3,2 + A6,4A5,2A3,1 — A6,4As,3A2,l 

+A6,5A4,1 A3,2 — A6 j 5A4,2A3,l + A6,sA4,3A2,l 



B Matchgate Recursion 

The body of this paper has focussed on an algebraic recursion that allowed 
us to construct (n + l)-bit standard signatures out of n-bit standard sig- 
natures. One may wonder if there is a planar matchgate counterpart - 
that is, is there some sort of recursive planar matchgate structure that 
reflects this. There is, and we offer one such possibility below. We begin 
by reviewing a particularly useful 4-bit standard signature. 



V 



F as: 



Lemma 11 Define the switch function f switch 

/smutch (0000) = f swltch {Q\Ql) = (1010) = 1 

f switch (1111) = — 1 

Then the switch function is a standard signature. 

PROOF: It is possible to prove this result only using algebra, but 
it is simpler to construct the switch matchgate directly. These planar 
matchgates are modified versions of Figure 8 from Valiant |14j . 

First, suppose that F is not characteristic two. Then \ S F, and we 
can consider the following planar matchgate (where unmarked edges have 
weight 1): 

1 




On the other hand, if F has characteristic two, we can use the following 
planar matchgate (where all edges have weight 1): 
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1 



2 i 



+ 3 



If we count up the weighted perfect matchings for these two graphs 
over their respective fields, they produce the switch function, as desired. □ 

To simplify our diagrams, we will (following Valiant) adopt the fol- 
lowing emblem for the switch matchgate, where the underlying planar 
matchgate is chosen from the two above depending on the base field's 
characteristic: 



Since the outputs are symmetric under rotation in the plane, we can ignore 
the labels without causing any ambiguity. If we consider input/output 
nodes 1 and 3, observe that either they must both be saturated, or neither 
of them is saturated. In other words, the planar matchgate acts as though 
there were a "virtual edge" between the nodes. The same principle applies 
to nodes 2 and 4. 

Notice that over fields of characteristic two, the switch matchgate is 
equivalent to letting two edges cross each other (since /™ack(HH) = 
—1 = 1 mod 2). In other words, for those particular fields, the planarity 
requirement in a planar matchgate is redundant; we can simply take any 
non-planar crossings and replace them with planar switch matchgates. 
We can state this corollary formally: 

Corollary 4 If we operate over a field F of characteristic 2, we can re- 
move the planarity restriction from the definition of a planar matchgate 
without changing the resulting set of standard signatures. 

In any event, the purpose of this section is to provide a recursive 
planar matchgate construction that mirrored the algebraic recursion from 
Subsection 12.51 Here is one example, where we choose arbitary \i £ F, 
and all unmarked edges have weight one. 



1 



2 



> 4 



3 



2G 



n+1 1 



n-2 n-1 n 



\K-2 

-9h 



• — • 



• — • 



• — • 




n-2 n-1 n 
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